Yahoo Seeks Further Dismissals in Data Breach Class Action

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Yahoo has requested another round of dismissals in a litigation over three data breaches that exposed millions of users’ sensitive information.

The company filed a new motion for dismissal on Jan. 19, asking U.S. District Judge Lucy H. Koh to dismiss a handful of claims from the plaintiffs’ most recent amended complaint.

The new complaint is the plaintiffs’ attempt to reassert claims that Judge Koh dismissed from their Yahoo class action lawsuit last August. Yahoo now argues the plaintiffs have failed to correct the deficiencies that got these claims dismissed.

“Plaintiffs’ [First Amended Complaint] defaults to broad generalizations, legal conclusions, and threadbare assertions in place of well-pled facts specifically linking the injuries claimed in this case to the facts alleged,” the motion says.

According to Yahoo, three of the plaintiffs have failed to allege that they were financially harmed, making their claims under California’s Unfair Competition Law inadequate. Another claim under the Consumer Legal Remedies Act should be dismissed because the plaintiffs can’t show they relied on a representation by Yahoo, or that they received a “good” or “service” from Yahoo within the statute’s meaning, according to the motion.

The plaintiffs’ claims for contractual unconscionability are based only on “threadbare recitals and conclusory allegations,” Yahoo claims, and the contractual provisions at issue are routinely enforced in situations like this where plaintiffs have a choice among free and low-costs service providers.

New claims raised in the First Amended Complaint also fail for similar reasons, the company argues. Yahoo says the plaintiffs can’t show the requisite reliance or damages to properly state their fraudulent concealment claim. That claim and their negligence claim also fail under a rule that prohibits tort claims based on solely economic losses.

Plaintiffs also raise a new claim under a 2016 amendment to the Customer Records Act, which now requires “reasonable security measures” for “online account” information. Yahoo argues that as a matter of law, this new provision does not apply retroactively to its 2013 and 2014 data breaches.

This consolidated data breach class action lawsuit ensued after Yahoo announced in September 2016 that an upper-level Yahoo employee fell for a “spear phishing” attack almost two years before. Hackers then made off with data on at least 500 million Yahoo users, including their hashed passwords.

Three months after that announcement, Yahoo announced an earlier breach from 2013 that exposed the data of 1 billion users. A third Yahoo data breach was announced in October 2017, in which hackers used forged cookies to get into the accounts of 32 million Yahoo users without needing their passwords.

The plaintiffs are represented by attorneys John A. Yanchunis of Morgan & Morgan Complex Litigation Group, Ariana J. Tadler of Milberg LLP, Karen Hanson Riebel of Lockridge Grindal Nauen PLLP, Stuart A. Davidson of Robbins Geller Rudman & Dowd LLP, and Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP.

The Yahoo Data Breach Consolidated Class Action Lawsuit is In re: Yahoo! Inc. Customer Data Security Breach Litigation, Case No. 5:16-md-02752, in the U.S. District Court for the Northern District of California.

UPDATE: On March 9, 2018, a federal judge trimmed some claims in a Yahoo email data breach multidistrict litigation, but lets others stand, finding flaws in most of the consumers’ effort to sue for punitive damages.

UPDATE 2: On Oct. 22, 2018, Yahoo users are seeking approval from a California federal judge for a $50 million settlement deal that would end three class action lawsuits claiming that Yahoo’s negligence led to data breaches affecting American and Israeli email users.

UPDATE 3: On Jan. 28, 2019, a federal judge denied a $50 million Yahoo class action settlement, finding the proposed deal lacked specific information about ways the tech company would improve data security.

UPDATE 4: On April 9, 2019, Yahoo has now agreed to pay $117.5 million to resolve legal claims regarding three large data breaches that affected the internet company.

UPDATE 5: On July 20, 2019, a federal judge has preliminarily signed off on a $117 million class action settlement agreement between Yahoo and accountholders who were affected by numerous data breaches.

UPDATE 6: September 2019, the Yahoo data breach class action settlement is now open. Click here to file a claim.